1. Purpose and Scope
LİKE TEKSTİL SANAYİ VE TİCARET A.Ş. (“Company”) adopts the principle of conducting all its activities in compliance with personal data protection legislation and ensuring the highest level of protection of the fundamental rights and freedoms of personal data subjects.
This Policy covers the entire Company and applies to all personal data processing activities carried out by the Company in its capacity as a data controller.
2. Definitions
For the purposes of the implementation of this Policy, the following terms shall have the meanings set forth below:
Employees
Refers to the employees of the Company.
Personal Data Subject (Data Subject)
Refers to the natural person whose personal data are processed (e.g. employee, visitor).
Processing of Personal Data
Refers to any operation performed on personal data, whether fully or partially automated, or by non-automated means provided that it forms part of a data recording system (e.g. collection, recording, storage, alteration, transfer).
KVKK (Law)
Refers to the Law No. 6698 on the Protection of Personal Data.
KVKK Board
Refers to the Personal Data Protection Board.
KVKK Authority
Refers to the Personal Data Protection Authority established under Law No. 6698, having administrative and financial autonomy.
Special Categories of Personal Data
Refers to personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Data Processor
Refers to the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Recording System
Refers to a system in which personal data are processed by being structured according to specific criteria.
KVKK Working Group
Refers to the group consisting of employees or consultants with defined roles and responsibilities appointed to ensure the Company’s compliance with the Law.
3. Data Controller
Within the scope of personal data processing activities carried out under this Policy, the data controller is:
Like Tekstil San. ve Tic. A.Ş. (MYBESTFRIENDS)
Tax Office: Beylikdüzü Vergi Dairesi
Tax Identification Number (VKN): 6080641867
Address:
BEYLIKDUZU OSB. BIRINCI BLV. 3. CD. 1/A
MYBESTFRIENDS MERKEZ OFIS
BEYLIKDUZU / ISTANBUL
4. Inventory and Record Keeping
The Company maintains a personal data processing inventory in order to monitor and manage personal data processing activities and to ensure compliance with legal obligations. Within this inventory, personal data categories, processing purposes, recipient groups, and retention periods are determined in association with business processes. A summary of the inventory is declared via the VERBIS platform.
5. Training and Awareness
The Company ensures that employees involved in personal data processing activities or having access to personal data receive regular training on legislation and information security.
6. Protection of Personal Data and General Principles
The Company conducts personal data processing activities in compliance with the KVKK and adheres to the following principles:
-
Processing in accordance with the law and the principle of good faith
-
Accuracy and keeping data up to date where necessary
-
Processing for specific, explicit, and legitimate purposes
-
Being relevant, limited, and proportionate to the purpose
-
Retention for the period stipulated by relevant legislation or required for the purpose of processing
7. Lawfulness and Conditions for Processing
Personal data are processed based on the legal grounds set out in Articles 5 and 6 of the KVKK. Explicit consent is only one of these legal grounds.
As the transfer of personal data of individuals outside the Company through the Company’s e-mail system is deemed a transfer of personal data abroad pursuant to Board decisions, explicit consent is obtained in such cases in accordance with Article 5/1 of the KVKK.
8. Special Categories of Personal Data
The Company attaches utmost importance to the protection of special categories of personal data and applies the administrative and technical measures stipulated under the KVKK in the processing of such data.
9. Transparency and Obligation to Inform
Personal data subjects are informed about the identity of the data controller, purposes of processing, parties to whom data are transferred, method and legal grounds of data collection, and their rights under the KVKK.
In exceptional cases listed under Article 28 of the KVKK, the obligation to inform shall not apply.
10. Rights of Personal Data Subjects
Pursuant to Article 11 of the KVKK, personal data subjects have the following rights:
-
To learn whether their personal data are processed
-
To request information if their personal data have been processed
-
To learn the purpose of processing and whether data are used in accordance with that purpose
-
To know the third parties to whom personal data are transferred domestically or abroad
-
To request correction of incomplete or inaccurate personal data
-
To request deletion, destruction, or anonymization of personal data
-
To object to results arising against them through automated systems
-
To request compensation for damages arising from unlawful processing
11. Data Security and Breaches
The Company takes necessary administrative and technical measures to prevent unlawful processing and access to personal data. In the event of a personal data breach, the situation is reported to the relevant data subjects and the KVKK Board as soon as possible.
12. Destruction of Personal Data
Personal data whose retention period has expired are deleted, destroyed, or anonymized. These actions are carried out within the scope of periodic destruction processes conducted at least twice a year.